Governance
Regulators, insurers, and plaintiffs' attorneys are converging on a new standard. What 'adequate AI oversight' means for directors is being defined right now, and the definition is moving faster than most boards realize.
Five years ago, a board director with no AI expertise and no AI-specific governance process was in a defensible position. There was no established standard of care, no regulatory expectation, no case law, and no widely adopted framework against which a director's conduct could be evaluated. "We did not have the tools" was a reasonable answer.
That answer is no longer available.
The shift from oversight to accountability is happening in four places at once. The pace of movement across all four has accelerated sharply in the past eighteen months.
Regulatory guidance. The SEC has issued explicit guidance on AI-related disclosure obligations. The EU AI Act establishes governance requirements that affect any company with EU operations or EU customers. State legislatures in Colorado, California, and Illinois have passed or are advancing AI governance legislation that creates board-level accountability requirements. The direction is consistent. Boards are expected to demonstrate structured AI oversight.
Fiduciary duty doctrine. Delaware courts have not yet resolved a major AI governance case, but the analytical framework they would apply is not new. The Caremark standard established that directors can be liable for a failure to implement adequate oversight systems. It applies directly to AI governance. A board that received no reporting on AI risk, established no oversight structure, and made no documented effort to understand its AI exposure is in the same position as a board that failed to implement financial controls. The novelty of the technology does not change the doctrine.
Insurance underwriting. D&O and cyber insurers now routinely ask governance questions during underwriting. The questions go beyond cybersecurity posture into AI governance maturity. The questions they ask define what they consider adequate oversight. Boards whose governance posture does not meet that standard are finding that their coverage is narrower than they assumed, or that their premiums reflect it.
Shareholder expectations. Institutional investors and proxy advisors are developing AI governance criteria. ISS and Glass Lewis have both signaled that AI oversight will become a factor in governance ratings. Boards that cannot articulate a coherent AI governance posture face increasing scrutiny from investors who have their own fiduciary obligations to manage.
There is no single authoritative definition. The contours are becoming clear from the convergence of the four sources above. Adequate AI oversight, as the standard is currently taking shape, involves:
None of this requires technical expertise. It requires the same structured oversight discipline that boards apply to financial, legal, and operational risk, applied to a new class of material exposure.
Boards that build governance records now will be in a materially better position than boards that wait for the first major case to clarify the standard. Running assessments. Documenting oversight processes. Establishing structured AI reporting. The standard is being set now. The boards that participate in setting it, rather than being evaluated against it retroactively, are the ones that will find it most defensible.
The shift from oversight to accountability is already happening. It describes where AI governance is today.
The Compass is where every Vela engagement begins. Request access or a briefing to see what it surfaces for your board.